Vulnerability · medium · CVSS 6
Apache Shiro saved form replay may weaken cookie security (CVE-2026-88019)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: shiro-jakarta-ee users on affected Apache Shiro versions
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade shiro-jakarta-ee to 3.0.2 or later
The Brief
- Apache Shiro advisory CVE-2026-88019 covers saved form replay that may weaken cookie security and expose form data.
- Affected: org.apache.shiro:shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2.
- The advisory rates it CVSS 4.0 6.0 (medium).
Why it matters
Applications on affected shiro-jakarta-ee versions may have weakened cookie security and exposed form data until they upgrade to 3.0.2 or later.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java security framework that developers build and run applications with. |
| No | Core infrastructure | Judgment: A single Java framework, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Shiro is a widely used Java framework across many teams, though not top-tier. |
| No | Exploited in the wild | Open Source Security: advisory only describes the flaw; no observed attacks reported. |
| No | Public exploit | Open Source Security: advisory only; no exploit code or proof-of-concept mentioned. |
| No | Remote, no login | Open Source Security: CVSS vector shows PR:N but UI:P, so user interaction is required. |
| No | Full takeover | Open Source Security: impact described as cookie weakening and form data exposure, not code execution or takeover. |
| No | Secrets exposed | Open Source Security: flaw may expose form data; no source reports data actually stolen. |
| No | Supply chain | Open Source Security: a normal vulnerability in legitimate code; no malicious shipping reported. |
| No | No fix yet | Open Source Security: affected versions are before 3.0.2, implying a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability posted to oss-security by Lenny Primak
Open Source Security
CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data
Source
CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data ↗ Open Source Security · 56 min ago
First seen · 1 source · Full story page · How tiers are decided